PDF malware analysis — malicious · 35e39062c4391275

MALICIOUS

PDF

67.2 KB Created: 2020-11-27 10:00:19 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-02

MD5: 4fecb5a0432a07080ce765197c4a30c3 SHA-1: 1522d4c835c51b8677ac4f9ef990b3397281af20 SHA-256: 35e39062c43912755f44026446b1f0f33b2b98843b3d76bf70155422debea127

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafffi.ru/aws?utm_term=brain+power+workout+pdf PDF link annotation
- https://cdn-cms.f-static.net/uploads/4416132/normal_5fa0fb6b33272.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4369511/normal_5fae4be07d787.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4464080/normal_5fb48d6e7faf9.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4384484/normal_5f9a3cc9b262e.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4375340/normal_5f930c4d0645e.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4382771/normal_5f921454bf41d.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/c7dbaf4d-f365-4031-850d-18f19d277a6c/palme_lys_kimya_soru_bankas_zmle.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5a0bab5e-d4fe-4c68-aa42-3a8e109a3837/sijapot.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/68a30b9a-bdfa-4a70-85a2-1a9bd965f634/dominos_white_sauce_recipe.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fff2896e-aa9e-4bc7-ad83-b7f657b42da5/dokozuw.pdfIn PDF document text
- https://s3.amazonaws.com/serogajugomiji/group_of_prairie_dogs_is_called_what.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000cc56.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCC56	5028 bytes
SHA-256: `f27251eb07d13f4bd7905d79082de4a6d7c58c7604e8dee00516bcea385f3ef0`
`font_01_sfnt_off0000dd9a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDD9A	10460 bytes
SHA-256: `400ec66e3bac2c836db37fe765a36b91258de245817aa1da987f69047ff27a6d`

Open this report in the interactive analyzer, or submit your own file for analysis.